Saturday, 15 January 2011

Avoid HTML escaping in bottle (python) -


I am making a song song webpage in the bottle (python), and I am checking that all the data It's right for the database, so, now, I basically have a form that has "song name", "artist", "song" (in a teddy bear) and that's it.

When the form submits it, the page loads which has the above three input values ​​(songs, artists and songs) and everything works as expected but the song 'html is running out (The template I replaced with all \ n with and
), and found that the XPS escaped the HTML tags of the bottles to prevent attacks and you Before the "name!" Variable name, AWESOME! I found the solution, but ... when I tried to use it, it threw an error:

  Exception: SyntaxError ('invalid syntax', ( 'H: \\ server \\ htdocs \\ letras \\ prueba.tpl', 4, 27, 'u' div & gt; Lera: ', _escape (! Letra [' letra ']), u' & Lt; / div & gt; 'traceback' (most recent call final): File "H: \ server \ HTOX \ leress \ bottle_package", line 764, "H: \" in the Line of Return Range (** RGR) File "index.p.in" server \ htdocs \ letras \ bottle.py ", line 1575, wrapper rv = callback (* a, ** ka) Y ", line 41, in the guardar_letra return template ('prueba.tpl', letra = data) file" H: \ server \ HTOX \ lace \ boaty package ", line 3117, [tupid] in template return templates .Reder (quargus) File "H: \ server \ HTOX \ lasas \ bulletap", line 3090, in self-sufficient. Execute (stdout, kwargs) file "H: \ server \ htdocs \ letras \ bottle.py", line 3078, executed eval (self. Co, env) in the file "h: \ server \ htdocs \ Letras \ bottle.py", line 185, in __get__ value = obj .__ dict __ [self.func .__ name__] = self.func (obj) file " H: \ SER R \ htdocs \ letras \ bottle.py ", line 2 977, co-return compile (the code itself, Selffail name or '& lt; String & gt; ',' exec ') File "H: \ server \ HTOX \ Lars \ Praia. Tpl", line 4 U' & lt; Div & gt; Letra: ', _escape (! Letra [' letra ']), U' & lt; / Div & gt; ']) Syntax error: invalid syntax   

This is my index.py

  Bottle import from bottle, route, Import, import, import, sha256_crypt import, import, import, import, import, import, import, import, import, import, import, import, import, import, Enviar_letra.tpl ') @ post (' enviar ') def guardar_letra (): titulo = request.forms.get (' titulo '). Capitalize () # Get the title of the song from the form artist = song- request.forms.get ('Artista') # Artist Letra = request.forms.get ('letra') # song fecha_envio = time.strftime ('% Y-% M-% D% H:% M:% S ') # Songs were written titulo = re.sub (' [^ \ w | | | | | | S., |] ',' ', Titulo) # I leave each character: word, exclamation, spaces, dots, comma URL = Titulo + "-" + Artis ta # song title and artist name to a good url url = re.sub ('\ W + | _ ',' - ', url). Reduce all the characters from the command () # url url = url. Strip ("-") # strips "-" letra = letra.replace ("\ n", "
" # #) from # text text area & lt; Br> # Song dictionary return template ('prueba.tpl', letra = data): data = {"titulo": titulo, "artista": artista, "letra": letra, "url": url, "Fecha_envio": fecha_envio} Load the prueba.tpl templates and run the "Data" dictionary in "Letra" (song in Lara Spanish) (host = 'localhost', port = 8080, debug = true)

My template

  & lt; H1 & gt; Lera D {{letra ['titulo']}} & lt; / H1> & Lt; H2 & gt; Por: {{letra ['artista']}} & lt; / H2 & gt; & Lt; Div & gt; Fecha: {{Letra ['Fecha_envio']}} & lt; / Div & gt; & Lt; Div & gt; Lera: {{! Letra ['letra']}} & lt; / Div & gt;   

How does this work / looks if I displayed the bottle my songs as HTML (Notice how
is plain text Going away):

"text">

to open the announcing symbol right after {{ Bottle needs to be recognized for this:

  & lt; Div & gt; Lera: {{! Lera ['Letter']}} & lt; / Div & gt;   

Preferably, you want to clear the space to stay in a safe place:

  & lt; Div & gt; Lera: {{!! Letra ['letra']}} & lt; / Div & gt;    

No comments:

Post a Comment